Fail-closed by default
Every column must resolve to an explicit role before a run starts. Nothing is ever silently copied through unclassified, inference only ever suggests.
Deterministic pseudonymisation and privacy-preserving database cloning — for test, staging, and demo environments that need real-looking data without real PII.